Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-04-2024 08:50
Static task
static1
Behavioral task
behavioral1
Sample
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe
Resource
win11-20240412-en
General
-
Target
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe
-
Size
3.1MB
-
MD5
68ef35fcc712865e0bcd9b914b2f20dd
-
SHA1
807a84f9718c0295cae0f743de34195117977d95
-
SHA256
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003
-
SHA512
b5be8285bc8132b289726e6a89485ecd3f49b47b6fd6694c58cd8eb677fdc45a09c4f9ce83e8a5e21d17c7b64cf337d22dbcd7a405fe37ab1a2bdb0c7a652fbf
-
SSDEEP
49152:SIzYhTST0mYRT0SJNhcJFjBylfG1ihHXnppDBzWX1v:sTwaNhcJZUlUihppDBzWX1
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral2/memory/2052-553-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
explorha.exeb80351b5ea.exeexplorha.exeamert.exeexplorha.exechrosha.exeexplorha.exeexplorha.exe35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b80351b5ea.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amert.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exeflow pid process 26 3716 rundll32.exe 27 4880 rundll32.exe 49 1336 rundll32.exe 53 808 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1976 netsh.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorha.exeexplorha.exeb80351b5ea.exeamert.exeexplorha.exe35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeexplorha.exeexplorha.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b80351b5ea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b80351b5ea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe -
Executes dropped EXE 23 IoCs
Processes:
explorha.exeexplorha.exe8efc78470c.exeb80351b5ea.exeexplorha.exeamert.exechrosha.exeexplorha.exeswiiiii.exealexxxxxxxx.exepropro.exeTraffic.exegold.exeNewB.exejok.exeISetup8.exetoolspub1.exeswiiii.exeu3gw.0.exe4767d2e713f2021e8fe856e3ea638b58.exe4767d2e713f2021e8fe856e3ea638b58.exeexplorha.exeNewB.exepid process 1804 explorha.exe 3104 explorha.exe 1644 8efc78470c.exe 3108 b80351b5ea.exe 3924 explorha.exe 3552 amert.exe 3776 chrosha.exe 5012 explorha.exe 2184 swiiiii.exe 5032 alexxxxxxxx.exe 1972 propro.exe 2060 Traffic.exe 2892 gold.exe 2604 NewB.exe 1212 jok.exe 4496 ISetup8.exe 2292 toolspub1.exe 3016 swiiii.exe 4028 u3gw.0.exe 4612 4767d2e713f2021e8fe856e3ea638b58.exe 4208 4767d2e713f2021e8fe856e3ea638b58.exe 3656 explorha.exe 2812 NewB.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
amert.exe35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeexplorha.exeb80351b5ea.exeexplorha.exechrosha.exeexplorha.exeexplorha.exeexplorha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine amert.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine b80351b5ea.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine chrosha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exepid process 1016 rundll32.exe 3716 rundll32.exe 4880 rundll32.exe 3368 rundll32.exe 1336 rundll32.exe 808 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorha.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\b80351b5ea.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\b80351b5ea.exe" explorha.exe Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\8efc78470c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\8efc78470c.exe" explorha.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000055001\8efc78470c.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeexplorha.exeexplorha.exeb80351b5ea.exeexplorha.exeamert.exechrosha.exeexplorha.exeexplorha.exepid process 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe 1804 explorha.exe 3104 explorha.exe 3108 b80351b5ea.exe 3924 explorha.exe 3552 amert.exe 3776 chrosha.exe 5012 explorha.exe 3656 explorha.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
explorha.exeswiiiii.exealexxxxxxxx.exegold.exeswiiii.exedescription pid process target process PID 1804 set thread context of 3924 1804 explorha.exe explorha.exe PID 2184 set thread context of 1460 2184 swiiiii.exe RegAsm.exe PID 5032 set thread context of 4812 5032 alexxxxxxxx.exe RegAsm.exe PID 2892 set thread context of 2052 2892 gold.exe RegAsm.exe PID 3016 set thread context of 4524 3016 swiiii.exe RegAsm.exe -
Drops file in Windows directory 2 IoCs
Processes:
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeamert.exedescription ioc process File created C:\Windows\Tasks\explorha.job 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe File created C:\Windows\Tasks\chrosha.job amert.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2400 2184 WerFault.exe swiiiii.exe 3580 2292 WerFault.exe toolspub1.exe 3588 4612 WerFault.exe 4767d2e713f2021e8fe856e3ea638b58.exe 2112 4208 WerFault.exe 4767d2e713f2021e8fe856e3ea638b58.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub1.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
4767d2e713f2021e8fe856e3ea638b58.exechrome.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582494732788990" chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 4767d2e713f2021e8fe856e3ea638b58.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3777591257-2471171023-3629228286-1000\{5422EB2D-B1D1-4CB9-A886-73828A7BD7D2} chrome.exe -
Processes:
propro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 propro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 propro.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeexplorha.exeexplorha.exechrome.exeb80351b5ea.exerundll32.exepowershell.exeexplorha.exeamert.exechrosha.exeexplorha.exerundll32.exepowershell.exeTraffic.exepid process 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe 1804 explorha.exe 1804 explorha.exe 3104 explorha.exe 3104 explorha.exe 4848 chrome.exe 4848 chrome.exe 3108 b80351b5ea.exe 3108 b80351b5ea.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 4988 powershell.exe 4988 powershell.exe 4988 powershell.exe 3924 explorha.exe 3924 explorha.exe 3552 amert.exe 3552 amert.exe 3776 chrosha.exe 3776 chrosha.exe 5012 explorha.exe 5012 explorha.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 3424 powershell.exe 3424 powershell.exe 3424 powershell.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe 2060 Traffic.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exepowershell.exedescription pid process Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe8efc78470c.exechrome.exepid process 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 1644 8efc78470c.exe 4848 chrome.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
8efc78470c.exechrome.exepid process 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe 1644 8efc78470c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exeexplorha.exe8efc78470c.exechrome.exedescription pid process target process PID 648 wrote to memory of 1804 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe explorha.exe PID 648 wrote to memory of 1804 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe explorha.exe PID 648 wrote to memory of 1804 648 35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe explorha.exe PID 1804 wrote to memory of 1644 1804 explorha.exe 8efc78470c.exe PID 1804 wrote to memory of 1644 1804 explorha.exe 8efc78470c.exe PID 1804 wrote to memory of 1644 1804 explorha.exe 8efc78470c.exe PID 1644 wrote to memory of 4848 1644 8efc78470c.exe chrome.exe PID 1644 wrote to memory of 4848 1644 8efc78470c.exe chrome.exe PID 4848 wrote to memory of 1808 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1808 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4600 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 3656 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 3656 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4332 4848 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe"C:\Users\Admin\AppData\Local\Temp\35c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000055001\8efc78470c.exe"C:\Users\Admin\AppData\Local\Temp\1000055001\8efc78470c.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff99419ab58,0x7ff99419ab68,0x7ff99419ab785⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4164 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3336 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1840,i,12533685865550659365,13590153637986821384,131072 /prefetch:85⤵
-
C:\Users\Admin\AppData\Local\Temp\1000056001\b80351b5ea.exe"C:\Users\Admin\AppData\Local\Temp\1000056001\b80351b5ea.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 8883⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u3gw.0.exe"C:\Users\Admin\AppData\Local\Temp\u3gw.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 3884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 8685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 8204⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2292 -ip 22921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4612 -ip 46121⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4208 -ip 42081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD550af626b9f6b3f21aaabba600bb47e61
SHA1c23973b851532e8d19ad66d0017b7b46c7b462be
SHA2561c5f8e598e73eca1fbb7d31ce54953fe6844c4f708b1d6599ab3eeb88c1908d8
SHA512e12b8a5586740a7eb10b0053a128b6f2d23485d68e6808d07ec0b3da4c2dc57fba5dd9c3f79c515658882ab175164349c5380b84f232b1434eefd62495b5ec23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesFilesize
20KB
MD5b57f272f07f9138efd52b05d3d8c280a
SHA19e28184c8cf8484e5df9276268a720223d2fdad5
SHA256b2b4a7a56100aed6c7941d8c1e696e6de44af4bf28eb3279d6b100a03c205e4d
SHA5124e9a9688f22f3bee358648ce3a8e61b74b0db70d00d1e99d87d269f68161d54c96a4b2d7d2b804a296bb975690bf2899e7ae0632007be8ca6241b0759a4f3483
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD53b01924c7ab123f0365fd565a5c1cfb8
SHA1c1a20a5f61ba1d76f7f548c609971d558c6405f8
SHA256cea3b22c728b5b62d1c1a318e6e496bacbc7767f68ca477735f81f6c31e43138
SHA512d3546571167d102340dd00ae30266c8575d6bca8b6f696215df2d6247dab4a697ffeacef9741382a35751ad8964708521fe9c440806fbcc57849f0e678f6eb5b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD52f604bea9c704a5c6f98b60652dd9eac
SHA1c185e6d8a197c1bbddd6c6472df16581ef824487
SHA2562679eb5332efb465478124d8893c852904fc802b4b103ebabf8ab4c8e4f4ee67
SHA51271230279ff6700381e6252999ba2bb5025c0ea74c9d116ac94cd597c0d26c909c775950bb51bfc238b0f99ab5ea870dde56e06b5b3bc8b77b9605e474af53ed4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5731f65c777f91cb2b69bbd749c2bd437
SHA1d1ae02bcd1e731eee21ba7acc8a8d85068f578d3
SHA2563b46fc261531a99dfb0af0e8f44731573c506018ca76f3f6d620f579fa8f4c0a
SHA512dea5adbc7bdf77b301fd79f720efdd982d777aae0f8ed2e1a6e24ecb46bae036c84c1fb1fc45a3a235d7ebb215d5156a066e8ccba012503f522bc747521b72df
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5f3b6c6e4fa05bd630f1f5f632d186a06
SHA144ac1dfb4dad424d1bddb240d19ceeefb6541a6e
SHA256e153bf86292523d68d817d943cac25b70abc7476cbe88c53ddcd28154b9a3fc1
SHA51239abf512e129175c74f7d1430ab090d1ce6d06a18b1ffc4c18d9fc16a11e3ec61124e68b67485a358592e2619e8bac2cd46332a946c20e4c64a64b8c863e38cf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD51569acdb066ab495d97a2b1dd1599b85
SHA161f61c7c9124f5e216e135be7cf9c60be5d381ec
SHA256bf60785bcf26523ea6fcedfe5496a720d6d965d371e05e19419f5c1749cc0ba9
SHA5122044c98d5aef95fdde1f97518886a5514a031f7df28b0ca9013458755d77ad6f5043775f53103aa324316e872be4f360546a5030828632fa0e8e8e51f1190f0e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD56d7e6a5f417cd6c0fbf50c6c63e8b31f
SHA17ade984873e66eb828c275dfa3d4b09ca2e6e362
SHA25602fc620124d5b9e747ee3ddeded3b5a51df2395228886b7c1f8f50f5233bbbc2
SHA512e554ac45bd33e80d7d6cf98cc558e4a487a965e63d6044779f2f50c56f5fb53bb4ae8981ab74e29ec6bf68d4d878329a1cd5e71a905f62be196148c351ce4622
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5dc39144a836cfbe7daf71051755fe60f
SHA1f4d4aaefe9ebd864dcd36d8bc5d956d8c0ed7271
SHA256dd8c4e02aec3bba07412f241dd1a7ba52f72d3f4db1f76831472dc90e320deec
SHA5120bd2a5bbc776a757efe3ff1f7954298e0833ae5f6202e1bbac68ca61cc34c77514f713690c3c62c130f0e925d9b392115cb30e3bf27b28fdd457834149879750
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
252KB
MD51787c6c557c18e8df42a2f981c2b41ff
SHA15eaafcded7a3cbb028bfb2cffce09d089d454202
SHA256fb6ad10325891764f382c878227de71670f30d4c704d985ccbde0cc1f3be6e69
SHA5129ec8865a5dd28ddbf1d553c3a782b7af88b3391b99fa68ca55f9a0d0324420482d936ca90a5c1b3cb3df0751e9a9cb756c65fa200bf2e8b90fb1dc4c56c492f3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5a87844d5b61c42fc602f01070f37ec45
SHA1415b87ba63f0d908bb804ba10d91a74e536ad9f3
SHA2566a58c5abebd242398876f15234c7794b10fac5e79ac7ba1074b240a2acc30a81
SHA51263541fd2ed677c03c11af0c2433ada1e97dd1da818a33fe4ed7b9b897679a01acc1c8385f34051cae3516f249cd4c85978d52450280f9a355a61bdcbf33e5eb9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD57f2cf58208203ee67759e27748f182a1
SHA1c663ef1a64bffdc190bfc9de3e6c3062012217f2
SHA25643fadf034f504695435509490f72c06a22fa72762cd81e8ef67f239aa4b489e8
SHA512f5a6b508f888fe57c7918293624730f641efa61417b60739e0f63d31477c642881e7ba624cd6eb10db2faac6e56483d00f2c269557793f3d0893b29135d9b184
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeFilesize
3.1MB
MD568ef35fcc712865e0bcd9b914b2f20dd
SHA1807a84f9718c0295cae0f743de34195117977d95
SHA25635c4271577d3f6d7252fbd9b68fd35ae53a15653120073362eddccd086013003
SHA512b5be8285bc8132b289726e6a89485ecd3f49b47b6fd6694c58cd8eb677fdc45a09c4f9ce83e8a5e21d17c7b64cf337d22dbcd7a405fe37ab1a2bdb0c7a652fbf
-
C:\Users\Admin\AppData\Local\Temp\1000055001\8efc78470c.exeFilesize
1.1MB
MD51a2a9e7fb501cc9f7c6775d4484489c2
SHA186dba896d0c774893be462dad4f3e7da5bb3e4b7
SHA256fbc5fb232fac8efebcbf7c188ff32e56742e2d6dd88e09f78fdfe014643c45b1
SHA5120bceddd551624e4ca323f7ecef8897e8ddac71f13eca7bd4dfb80ea3539e0b444b33530aa04dc8df42675fb4ebda54a769a6e9f12b6de6a85fe836d93b4d302e
-
C:\Users\Admin\AppData\Local\Temp\1000056001\b80351b5ea.exeFilesize
2.3MB
MD5d88806d74b9aabd13af64b05ab541c25
SHA1c7f0bf36be6487fa63ba705f40dd547eb48d158b
SHA2562ee5ec104a29860cb1c1887e9ac868391e8d5dcdc70fe05a64383e1a64d2081a
SHA51278d4b8876d2a319e56a0ffad679b3a42a6567eab5d8efe85ac0fdbacfc42a92314fc887f7a129cac80889a030a73b9dd3ff5b6832e8bcfa79df107c51ecf927e
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exeFilesize
1.8MB
MD54ef2f13cc3d39f2d92602363bdc73de7
SHA12e759549065b33329eced0f96977ec70c0984bfd
SHA2562ce9797ab83e5441a1ba4baef6d85589760a2674c7f44573787e05a74db7827a
SHA5127935056156b6164f868b9ff389166b89c87d34d53230988f8bbd3974ccdf74e1a495cff987921088a37a6f46b13a0316672613d2b88062f73c3128636de74d3c
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
415KB
MD5b9b6303e6fc035a4b7a8b4c0f26b0fd3
SHA135c7493ed4ea1933b7b7af75019ebd1728b28cf5
SHA25668f5318b41db5ac869e493b9709cd9eeca46cfc125a7865c82b4cfc0d4790ad3
SHA51219fa5ec8ae1b45f245d80844ad4434c0d8ceb00e20da6607007ec18250081a37a14ef0096ba8c5e92d476fddcb31d17db94a6bb626ae886fd3287c71c4a1c497
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD5f050cdc7baaf85ee9a4487cb94b418ed
SHA1186dba34c17efe0c2cd4814d14b24df5176d9989
SHA256a377788ef4c4725d8eda4c014dbab9a25854f73d83ce4b523c383edc6889287f
SHA512fb8587c572d29b53f4369e0a3f7068a1660c53a24ce9ab07ac10f9b402dc6719716b76c5b26a9930778c6c80a17ec4883feb09e6d989e034e67889c57fa5b393
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zipFilesize
169KB
MD5b403ef95bf1684a50b63cb525babb71a
SHA1cad0fbd3cf5e7784c9df705464ab49ca80369ada
SHA2569d77599ab5903924147d6330b4b17a25b97474c6a7b2655489d6c1018e6d4843
SHA512db43050e79b1ea5a9a1fe71d9989a4d270a6b54027a4f54e96160a2ca0a3a4c90dec680139d7c5700d8701d984fdf642880fca151cad79269edb9ca7e377c306
-
C:\Users\Admin\AppData\Local\Temp\Tmp8E31.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\_Files_\SuspendDisconnect.docxFilesize
169KB
MD5e801fe52e8693a9d46b850f2de4e731c
SHA1f3add13929228ba3072fa4cace82923b8f814813
SHA2563e09c07c2c2ace1c3cbd38387b05d766deb953deff569fc7a77a8ed9a66d1083
SHA5120dea68582071b88098a35ceee0e9228248a2bd55ccd4aff00ec3323e33b7277ed013dfc616202741d7df888c31ce816333904275da94df5f764ba01d2155937e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5hq3p3vr.zfl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpAD45.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmpAD77.tmpFilesize
100KB
MD5d67511e6b6353f4790d1c1bfdf2f53ee
SHA1edd9873c0aa895f8af3dfeaee87edbda77a46aec
SHA256601cbdbcca7389cc5adf6e87730de1ab78f12e64097feb3129dda15b949701da
SHA51257474c3ab9426bac786d4d3b794bae856feb78a326fb8de6fae1fb86abcf196159ded93e21f887abd854118a4dab0e965aae506dd439846fa11f4042e5c52258
-
C:\Users\Admin\AppData\Local\Temp\u3gw.0.exeFilesize
270KB
MD5d682b7eec650bb1edc79acce3f71d0ca
SHA156392ae2bb70fee5e0e8a40530685831d8e3b4bf
SHA256141dad626684249a2b46737ac66f0345c6d47bdffcf3d2f4eadf8a3357fe1309
SHA51212cf09a164a9ae825a2bf89197d453388c5d74f684eee80ea9105f574badfb00eeda27fd7557d642241cbc86cf2f30833cd469d06dcdbb68806e4a7f4d7b507e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3777591257-2471171023-3629228286-1000\76b53b3ec448f7ccdda2063b15d2bfc3_dc25d36c-3a5d-4177-8466-03057136ebe3Filesize
2KB
MD5ce82977a94f7998e03e46bee081b4f91
SHA19131a8472a078d974c042254fb584f551da63481
SHA256b71d8490ad08423e8839c478890508917e59b777cb7112543e9abc8451e8f62a
SHA51255a8fea47936657c50ed7c4c1f91a78cdecde99eb084034ff7e64183c01b28d57c2098afdef50e37b2ed4faba362296453c48fe341a99fc29f70248cf6d32027
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
109KB
MD5726cd06231883a159ec1ce28dd538699
SHA1404897e6a133d255ad5a9c26ac6414d7134285a2
SHA25612fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA5129ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
1.2MB
MD515a42d3e4579da615a384c717ab2109b
SHA122aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA2563c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA5121eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5601bab861365f5f8ad14cd04a76bd9c7
SHA1da816d82f7ed51ab632a74427953b81a29da6ea4
SHA256f4b9d31121727593c534de88881bf7e973bd19ea6b4152a65f4c5524e2135ac0
SHA512f8c3a7aa7a8180f89d94468dd0d0e8ec10a741184af5bc765bbde76056f4c9c7435b9e0fe1a2ebd786dd98aafab93e0d83145a89ae0c713f97ee869fd044cf23
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5824f96522a625ad76525af2a1eb21e23
SHA14d68fcbcdf115d80ec15d7a4b023a37eaf301e89
SHA25668dada757f435dd00062f7d631eafc6f9e6b9e0afbc674f2eb5cfe031bd3a437
SHA51245e3bc636effcbe3c0ab91b4cfc91e3906ea24a4ab94e16f185bac2ebda9e28f6295821f139365d200d7124f3aac60fc9a1b3dc1bff5b91df86da736518b707f
-
\??\pipe\crashpad_4848_BKZOCWHZUFXSTTPIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/648-8-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/648-23-0x0000000000860000-0x0000000000B7D000-memory.dmpFilesize
3.1MB
-
memory/648-1-0x0000000077CF6000-0x0000000077CF8000-memory.dmpFilesize
8KB
-
memory/648-0-0x0000000000860000-0x0000000000B7D000-memory.dmpFilesize
3.1MB
-
memory/648-2-0x0000000000860000-0x0000000000B7D000-memory.dmpFilesize
3.1MB
-
memory/648-4-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/648-10-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/648-9-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/648-3-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/648-6-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/648-11-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/648-5-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/648-7-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/1460-381-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1460-378-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1804-597-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-386-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-34-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-266-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-318-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-33-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1804-124-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-31-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/1804-41-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1804-42-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/1804-322-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-29-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/1804-28-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/1804-219-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-141-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-27-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/1804-458-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-30-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/1804-168-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-24-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/1804-32-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/2052-553-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3104-37-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3104-26-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/3104-38-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/3104-36-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/3104-35-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/3104-39-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/3104-40-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/3104-43-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB
-
memory/3108-129-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/3108-136-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3108-319-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-324-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-387-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-126-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-128-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/3108-127-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/3108-130-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/3108-131-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3108-133-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/3108-460-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-134-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3108-279-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-135-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/3108-137-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/3108-138-0x0000000005470000-0x0000000005472000-memory.dmpFilesize
8KB
-
memory/3108-599-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-169-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-187-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3108-220-0x0000000000920000-0x0000000000F03000-memory.dmpFilesize
5.9MB
-
memory/3552-317-0x00000000002B0000-0x0000000000769000-memory.dmpFilesize
4.7MB
-
memory/3776-461-0x0000000000070000-0x0000000000529000-memory.dmpFilesize
4.7MB
-
memory/3776-682-0x0000000000070000-0x0000000000529000-memory.dmpFilesize
4.7MB
-
memory/3776-388-0x0000000000070000-0x0000000000529000-memory.dmpFilesize
4.7MB
-
memory/3924-242-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-260-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-275-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/3924-274-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/3924-272-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3924-276-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3924-277-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/3924-271-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/3924-248-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-247-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-246-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-245-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-244-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-243-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-269-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/3924-241-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-270-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/3924-267-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/3924-240-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-239-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-238-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-237-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-236-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-233-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-268-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/3924-249-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-250-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-265-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-251-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-252-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-253-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-254-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-255-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-256-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-257-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-258-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-264-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-263-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-262-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-261-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/3924-273-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/3924-259-0x0000000000400000-0x00000000009BD000-memory.dmpFilesize
5.7MB
-
memory/4524-774-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4524-777-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4812-466-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/4988-196-0x00000183FF690000-0x00000183FF6B2000-memory.dmpFilesize
136KB
-
memory/4988-197-0x00007FF990800000-0x00007FF9912C2000-memory.dmpFilesize
10.8MB
-
memory/4988-198-0x00000183997E0000-0x00000183997F0000-memory.dmpFilesize
64KB
-
memory/4988-199-0x00000183997E0000-0x00000183997F0000-memory.dmpFilesize
64KB
-
memory/4988-200-0x00000183997E0000-0x00000183997F0000-memory.dmpFilesize
64KB
-
memory/4988-206-0x00000183FF6C0000-0x00000183FF6D2000-memory.dmpFilesize
72KB
-
memory/4988-207-0x00000183FF670000-0x00000183FF67A000-memory.dmpFilesize
40KB
-
memory/4988-212-0x00007FF990800000-0x00007FF9912C2000-memory.dmpFilesize
10.8MB
-
memory/5012-353-0x0000000000CD0000-0x0000000000FED000-memory.dmpFilesize
3.1MB